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Abstract — Decoy state quantum key distribution (QKD) has 
been proposed as a novel approach to improve dramatically 
both the security and the performance of practical QKD set- 
ups. Recently, many theoretical efforts have been made on this 
topic and have theoretically predicted the high performance of 
decoy method. However, the gap between theory and experiment 
remains open. In this paper, we report the first experiments 
on decoy state QKD, thus bridging the gap. Two protocols of 
decoy state QKD are implemented: one-decoy protocol over 
15km of standard telecom fiber, and weak+vacuum protocol over 
60km of standard telecom fiber. We implemented the decoy state 
method on a modified commercial QKD system. The modification 
we made is simply adding commercial acousto-optic modulator 
(AOM) on the QKD system. The AOM is used to modulate the 
intensity of each signal individually, thus implementing the decoy 
state method. As an important part of implementation, numerical 
simulation of our set-up is also performed. The simulation shows 
that standard security proofs give a zero key generation rate at 
the distance we perform decoy state QKD (both 15km and 60km). 
Therefore decoy state QKD is necessary for long distance secure 
communication. Our implementation shows explicitly the power 
and feasibility of decoy method, and brings it to our real-life. 

I. Introduction 

Quantum key distribution (QKD)[1], [2] was proposed as 
a method of sharing a key between two parties (normally 
denoted by the sender Alice and receiver Bob) securely. It 
would be impossible for an eavesdropper to attack the QKD 
system without being detected. Assuming a perfect single 
photon source is utilized, people have proven the security of 
QKD based on fundamental laws of quantum physics [3], [4]. 

Unfortunately, in view of implementation, "perfect" devices 
are always very hard to build. Therefore most up-to-date QKD 
systems substitute the desired perfect single photon sources 
by heavily attenuated coherent laser sources. QKD can be 
performed with these laser sources over more than 120km of 
telecom fibers [5], [6]. 

However, this substitution raises some severe security con- 
cern. The output of coherent laser source obeys Poisson 
distribution. Thus the occasional production of multi-photon 
signals is inevitable no matter how heavily people attenuate 
the laser. Recall that the security of BB84 protocol [1] is 
guaranteed by quantum no-cloning theorem, the production of 



multi-photon signals is fatal for the security: the eavesdropper 
(normally denoted by Eve) can simply keep an identical copy 
of what Bob possesses by blocking all single-photon signals 
and splitting all multi-photon signals. Most up-to-date QKD 
experiments have not taken this photon-number splitting (PNS) 
attack into account, and thus are, in principle, insecure. 

Is it possible for people to develop some special measure to 
make QKD secure even with practical systems? The answer 
is yes. From physical intuition, if Alice sends out a single 
photon signal, and Bob luckily receives it, this bit (normally 
defined as in "single photon state") should be secure, because 
Eve cannot split or clone it. Based on this intuition, rigorous 
security analysis on practical QKD system is proposed by [7] 
and Gottesman-Lo-Liitkenhaus-Preskill (GLLP)[8], which is 
based on the entanglement distillation approach to security 
proofs. 

The main idea of GLLP's work is not to find which signals 
are secure (i.e., single-photon signals), because it would be 
beyond current technology. Instead, GLLP shows that the ratio 
of secure signals can be estimated from some experimental 
parameters, and secure key bits can then be extracted from 
the raw key based on this ratio through data post-processing. 

With the GLLP method the secure key generation rate, 
which is defined as the ratio of the length of the secure key 
to the total number of signals sent by Alice, is given by [8] 

R > q{-Q^f(E^H 2 (E^ +Q X [1- # 2 (ei)]}, (1) 

where q depends on the protocol; the subscript [i is the average 
photon number per signal in signal states; and are the 
gain and the quantum bit error rate (QBER) of signal states, 
respectively; Qi and e\ are the gain and the error rate of the 
single photon state in signal states, respectively; f(x) is the 
bi-directional error correction rate [9]; and H2{x) is the binary 
entropy function: H2{x) = — a;log 2 (a;) — (1 — x) log 2 (l — x). 
Qfj, and E^ can both be measured directly from experiments, 
while Qi and e\ have to be estimated (because Alice and 
Bob could not measure the photon number of each pulse with 
current technology). 

GLLP [8] has also given a method to estimate the lower 
bound of Q\ and the upper bound of e\, thus giving out the 



lower bound of the key rate R. However, with coherent laser 
sources, these bounds are not tight. It follows that the security 
of practical QKD set-ups can be guaranteed only at very short 
distance and very low key generation rate [8], [10]. 

A key question is thus raised: how can one extend both 
the maximum secure distance and key generation rate of 
QKD? The most intuitive choice would be to use a (nearly) 
perfect single photon source. Despite much experimental effort 
[11], reliable near-perfect single photon sources are far from 
practical. 

Another solution to increase the maximum secure distance 
and key generation rate is to employ decoy states, using extra 
states of different average photon number to detect photon- 
number dependent attenuation. The decoy method was first 
discovered by Hwang [12]. The first rigorous security proof 
of decoy state QKD was presented by us [10]. It is shown that 
the decoy state method can be combined with standard GLLP 
result to achieve dramatically higher key generation rates and 
longer distances [10]. Moreover, practical protocols with vacua 
and weak coherent states as decoys were proposed [10]. Sub- 
sequently, we have analyzed the security of practical protocols 
[13]. Decoy method has attracted great recent interests [14], 

The basic idea of decoy state QKD is as follows: Alice intro- 
duces some some "decoy" states with average photon numbers 
Vi besides the signal state with average photon number \x 
v^. Each pulse sent by Alice is assigned to a state (signal 
state or one of the decoy states) randomly. Alice announces 
the state of each pulse after Bob's acknowledgement of receipt 
of signals. The statistical characteristics (i.e., gain and QBER) 
of each state can then be analyzed separately. Note that the 
average photon number of certain state is only by statistical 
meaning, while Eve's knowledge is limited to the actual 
photon number in each pulse, therefore Eve has no clue about 
the state of each pulse. Eve's attack will modify the statistical 
characteristics (gain or QBER) of decoy states and/or signal 
state and will be caught. The decoy states are used only for 
catching an eavesdropper, but not for key generation. It has 
been shown [10], [13], [14] that, in theory, decoy state QKD 
can substantially enhance security and performance of QKD. 

The power and feasibility of decoy method can be shown 
only by implementing it. To implement decoy state QKD, 
it is intuitive to utilize variable optical attenuators (VOAs) 
to modulate the intensity of each signal to that of its state. 
Actually, this is exactly the way we used. 

II. Implementations of Decoy State Protocols 

In [10], [13], we have proposed several protocols on decoy 
state QKD. The most important two protocols are the one- 
decoy protocol (the simplest protocol) and the weak+vacuum 
protocol (the optimal protocol). We have implemented both 
of them, over 15km (the one-decoy protocol) and 60km (the 
weak+vacuum protocol) standard telecom fibers. 

A. Implementation of one-decoy protocol 

In one-decoy protocol, people need only one decoy state 
with average photon number per signal v < fi. Alice could 
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Fig. 1, Schematic of the set-up in one-decoy protocol experiment. Inside 
Bob/Jr. Alice: components in Bob/Alice's package of id Quantique QKD 
system. Our modifications: CA: Compensating AOM; CG: Compensating 
Generator; DA: Decoy AOM; DG: Decoy Generator. Original QKD system: 
LD: laser diode; APD: avalanche photon diode; <&i. phase modulator; PBS 
polarization beam splitter; PD: classical photo detector; DL: Delay line; FM 
faraday mirror. Solid line: SMF28 single mode optical fiber; dashed line 
electric cable. 



decide the values of /i and v, and the ratio of number of 
pulses used as decoy state to that of total pulses, then randomly 
assign the state to each signal by attenuating the intensity of 
each signal to either fi or v. 

We implemented the one-decoy protocol by adding acousto- 
optical modulators (AOMs, including CA, DA in Fig. [Qi 
to a commercial "Plug & Play" QKD system manufactured 
by id Quantique (Jr. Alice and Bob in Fig. 0. We choose 
AOM to modulate the signals because we need this amplitude 
modulation to be polarization insensitive. 

This QKD system is based on a 1550nm laser source 
with pulse repetition rate of 5MHz. Its intrinsic parameters, 
including dark count rate Yq, detector error rate edetector, and 
Bob's quantum efficiency r\Bob are listed on Table U 

Before experiment, we perform a numerical simulation 
(discussed in detail in Section IIIH with parameters of our 
set-up as in Table H] and optimally set /i and v to 0.80 and 
0. 120 photons respectively. The actual distribution of the states 
is produced by an id Quantique Quantum Random Number 
Generator. Around 10% of the signals are assigned as decoy 
states as suggested by numerical simulation. This random 
pattern is generated and loaded to the Decoy Generator (DG 
in Fig. before the experiment. 

Here we describe the flow of the experiment. First, Bob 
generates a chain of strong laser pulses by the laser diode 
(LD in Fig.[0 and sends them to Alice through the 15km fiber. 
Second, the pulses propagate through the AOMs (CA and DA 
in Fig. [2 the function of CA as well as CG will be discussed 
in the next paragraph), whose transmittances are set maximum 
at this period. Third, each pulse is splitted by a coupler and 
part of it will be detected by a classical photo detector (PD 
in Fig. [0, which generates synchronizing signal to trigger 

TABLE I 

Some intrinsic parameters of the QKD system. These 

PARAMETERS ARE DIFFERENT FOR THE TWO IMPLEMENTATIONS BECAUSE 
THE SINGLE PHOTON DETECTORS OF THE QKD SYSTEM WERE ADJUSTED 
BY THE MANUFACTURER BETWEEN THE TWO EXPERIMENTS. 
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the Decoy Generator (DG in Fig. 0. Fourth, the generator 
holds for certain time period, during which the pulses are 
reflected by the faraday mirror (FM in Fig. Q an d quantum 
information is encoded by the phase modulator ($,4 in Fig.[lJ. 
Here comes the key point: fifth, the Decoy Generator (DG in 
Fig.Q will drive the Decoy AOM (DA in Fig.[0 to modulate 
each pulse to the intensity (either 0.80 or 0.120) of the state it 
is assigned to exactly when the pulse propagates through the 
AOM. Sixth, the pulses (now in single photon level) return to 
Bob through the 15km fiber again. Seventh, Bob decodes the 
quantum information by modulating the phases of the pulses 
by the phase modulator ($5 m Fig- [D an d see which single 
photon detector (APD in Fig. fires. 

The use of the Decoy AOM (DA in Fig. [TJ shifts the 
frequency of the laser pulses, thus shifts the relative phase 
between pulses significantly. To compensate this phase shift, 
another AOM, the "Compensating AOM" (CA in FIG. [TJ is 
employed to make the total phase shift multiples of 2tt. This 
AOM is driven by the second function generator, "Compensat- 
ing Generator" (CG in FIG.[D- Its transmittance is set constant 
throughout the experiment. 

Here we emphasize that the holding time of the Decoy 
Generator (DG in Fig. Q after being triggered by the photo 
detector (PD in Fig. Q must be very precise, because same 
modulation must be applied to the two pulses of the same 
signal to keep visibility high. In our experiment, the precision 
of this holding time is 10ns. 

After the transmission of all the signals, Alice broadcasted 
to Bob the distribution of decoy states as well as basis in- 
formation. Bob then announced which signals he had actually 
received in correct basis. We assume Alice and Bob announced 
the measurement outcomes of all decoy states as well as a 
subset of the signal states. From those experimental data, Alice 
and Bob then determined Q^, Q v E^, and E v , whose values 
are now listed in Table UTI Note that our experiment is based on 
BB84 [1] protocol, thus q = N^/N, where N$ is the number 
of pulses used as signal state when Alice and Bob chose the 
same basis, and N = 105Mbit is the total number of pulses 
sent by Alice in this experiment. 

Now we have to analyze the experimental result and esti- 
mate the lower bound of key generation rate R. This can be 
done by simply inputting the results in Table HTlto the following 
equations [13]: 
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Fig. 2. Schematic of the set-up in weak+vacuum protocol experiment. Inside 
Bob/Jr. Alice: components in Bob/Alice's package of id Quantique QKD 
system. Our modifications: AOM: Decoy AOM; FG: Functional Generator. 
Original QKD system: LD: laser diode; APD: avalanche photon diode; 
<E>i: phase modulator; PBS: polarization beam splitter; PD: classical photo 
detector; DL: Delay line; FM: faraday mirror. Solid line: SMF28 single mode 
optical fiber; dashed line: electric cable. 



the lower bound of key generation rate is 

R>R L = q{-Q^f(E^)H 2 (E^ + Q\ [1 - H 2 (e?)}} (4) 

In our analysis of experimental data, we estimated e\ and 
Qi very conservatively as within 10 standard deviations (i.e., 
m q =10), which promises a confidence interval for statistical 
fluctuations of 1 — 1.5 x 10~ 23 . 

Even with our very conservative estimation of e\ and Qx, 
we got a lower bound for the key generation rate R L = 3.6 x 
10 -4 per pulse, which means a final key length of about L = 
NR ~ 38kbit. We also calculated Rperfect = 1-418 x 10~ 3 , 
the theoretical limit from the case of infinite data size and 
infinite decoy states protocol, by using Eq. (1). We remark 
that our lower bound R L is indeed good because it is roughly 

1/4 Of Rperfect- 

B. Implementation of weak+vacuum protocol 

Weak+ Vacuum protocol is similar to one-decoy protocol 
except that it has one more decoy state: the vacuum state, 
which has zero intensity. The vacuum state is to detect the 
background count rate. We hereby use the same notation for 
intensities as Subsection I1I-AI fi for signal state and v < p 
for weak decoy state. 

Weak+ Vacuum protocol is theoretically predicted to have 
higher performance than one-decoy protocol and is optimal 
protocol in asymptotic case [10], [13]. Our numerical simu- 
lation (detailed discussion in Section IIIII shows that for our 
set-up (as in Table UJ, with data size of 105Mbit, the maximum 
secure distance for one-decoy protocol is 59km, while that of 
weak+vacuum protocol is 68km, as shown in Fig.|4] We chose 
60km telecom fiber to perform weak+vacuum protocol. 

The implementation of weak+vacuum protocol requires 
amplitude modulation of three levels: p, v and 0. Note that it 

TABLE II 

Experimental results in one-decoy protocol. As required by 
gllp [8], bit values for double detections are assigned 
randomly by the quantum random number generator. 



where N v is the number of pulses used as decoy states, and 
eo (=1/2) is the error rate for the vacuum signal and therefore 
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would be quite hard for high-speed amplitude modulators to 
prepare the real "vacuum" state due to finite distinction ratio. 
However, if the gain of the "vacuum" state is very close (like 
within a few standard deviations) to the dark count rate, it 
would be a good approximation. 

Our set-up to implement weak+vacuum protocol (Fig. |2jl is 
very similar to that of one-decoy protocol (Fig. ^ except for 
the absence of the "compensating" parts (CA & CG in Fig. 
This is because the frequency of the AOM (AOM in Fig. 

has been precisely adjusted to the value that the phase shift 
caused by it is exactly multiples of 2tt. In other words, this 
AOM is self-compensated for our set-up. 

We performed numerical simulation (as discussed in details 
in Section Hill to find out the optimal parameters. According 
to simulation results, we choose the intensities as /i = 0.55, 
v = 0.152. Numbers of pulses used as signal state, weak decoy 
state and vacuum state are = 0.635A, N v = 0.203iV, and 
N a = 0.162A, respectively, where N = 105Mbit is the total 
data size we used. 

The experimental results are shown in Table [TO] Note that 
the gain of vacuum state (Yb in Table IIIH is indeed very close 
to the dark count rate (Yq in Table |l| third row), therefore 
the vacuum state in our experiment is quite "vacuum". We 
could estimate the lower bound of Qi and upper bound of 
e\ by plugging these experimental results into the following 
equations [13]: 
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and takes the value as in Eq. 0. Again, we estimate 
Qi and ei very conservatively by setting u a = 10, which 
promises a confidence interval for statistical fluctuations of 
1 - 1.5 x 10~ 23 . 

A lower bound of the key generation rate R L — 8.45 x 10~ 5 
per pulse is found by plugging the results of Eqs. @ into Eq. 
0, which means a final key length of about L = NR ~ 9kbit. 
Note that, one-decoy protocol cannot give out a positive key 
rate at 60km as suggested by numerical simulation. Therefore, 
weak+vacuum protocol is on demand at this distance. 

TABLE ni 

The experimental results of weak+vacuum protocol. 
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Fig. 3. Simulation result of the set-up on which we implemented the one- 
decoy protocol. Intrinsic parameters for this set-up is shown in the second 
row of Table Solid line: the theoretical limit of key generation rate. Its 
maximum transmission distance is about 90km. Dashed line: the performance 
of weak+vacuum protocol. Its maximum distance is about 70km. Dotted line: 
the performance of one-decoy protocol. Its maximum distance is about 64km. 
Dashed and dotted line: the performance without decoy method. Its maximum 
distance is only 9.5km. 



III. Numerical Simulation 

Numerical simulation is crucial for setting optimal ex- 
perimental parameters and choosing the distance to perform 
certain decoy method protocol. Here we explain the principle 
of our simulation, and show some results. 

The principle of numerical simulation is that for certain 
QKD set-up, if the intensities and percentages of signal 
state and decoy states are chosen, we could simulate the 
experimental results (gains and QBERs of all states). For 
example, suppose we have a QKD set-up with transmittance 
77, detector error rate edetector and dark count rate Yq, if the 
output intensity is set to be fi photons per signal, the gain and 
QBER of this state is expected to be [15] 

Qu = Y + 1 - e-w 



= -^-{e Y Q + e dete ctor(l ~ e 



(7) 



respectively. With these simulated experimental outcome, we 
could estimate the lower bound of the key generation rate. 

In experiment, it is natural to choose the intensities and 
percentages of signal state and decoy states which could 
give out the maximum key generation rate. This search for 
optimal parameters can be done by numerical simulation and 
exhaustive search. For example, we could try the values of 
H and vi, the intensities of signal state and decoy states, 
in the range of [0, 1] with a step increase of 0.001. Similar 
strategy can be applied on the percentage of each state. With 
certain combination of intensities and percentages, the gains 
and QBERs of different states could be simulated by Eqs. 
0, and the key generation rate can be estimated by the 
chosen protocol, like Eqs. (|2j(|3|l(0} for one-decoy protocol and 
Eqs. Q©0(|6} for weak+vacuum protocol. We can therefore 
find out the optimal combination that can give maximum key 
generation rate. 



Numerical simulation can also give the maximum secure 
distance for certain decoy protocol and QKD set-up. The 
transmittance of the system is a simple function of distance 
[15] rj — T]Bob^~ > where a(=0.21dB/km in our set-up) is 
the loss coefficient. For a QKD set-up with known rjBob, 
ct, edetector, and Yq, we could find out the maximum key 
generation rate of some protocol at distance I. The shortest 
distance at which the maximum key generation rate for certain 
protocol hits zero is defined as maximum secure distance for 
this protocol on this set-up. It would probably be a waste of 
time to perform certain decoy state protocol far beyond its 
maximum secure distance. 

We performed numerical simulation based on the set-up on 
which we implemented the one-decoy protocol. The result is 
shown in Fig. [3] The power of decoy method is explicitly 
shown by the fact that the maximum distance in absence of 
decoy method is only 9.5km. In other words, at 15km, not 
even a single bit could be shared between Alice and Bob with 
guaranteed security. In contrast, with decoy states, our QKD 
set-up can be made secure over 60km, which is substantially 
larger than the secure distance (9.5km) without decoy states. 

The set-up on which we implemented the weak+vacuum 
protocol is a bit different from the one we implemented 
the one-decoy protocol because the single photon detector 
had been adjusted by the manufacturer and several important 
properties, including iiBob, Yq and edetector, were changed, as 
shown in Table|l] The simulation result for this "new" set-up is 
shown in Fig. |4] Clearly, the expected performance, including 
the key rate of certain distance and maximum secure distance 
of certain protocol, of this set-up is different from the previous 
one. This difference is natural because the properties of the 
system have changed. 

The advantage of weak+vacuum protocol over one-decoy 
protocol is shown by the fact that the maximum secure 
distance of one-decoy protocol is 59km, which means that one- 
decoy protocol cannot give out a positive key rate at 60km. 
We confirmed this numerical simulation result by plugging 
experimental results Q^, E^, Q v and q from Table ITTT1 into 
Eqs. 0(|3|l® and found indeed that key rate is not positive. 

The maximum secure distance of our set-up is limited by 
equipment, especially the single photon detectors we used 
(APDs in Figs. ^&|2j. Given a better set-up (higher rjBob, 
lower edetector and Yo), secure decoy state QKD can be 
experimentally implemented over 100km, as shown in [13]. 

IV. Conclusion 

For the first time, we have implemented decoy state QKD. 
We have implemented two protocols: the one-decoy protocol 
and the weak+vacuum protocol. Simple modifications (adding 
AOMs) on a commercial QKD system are made to implement 
decoy state QKD. The simplicity of the modification (much 
simpler than building a near-perfect single photon source) 
shows the feasibility of decoy method. Also, the high key rates 
and long transmission distances (60km) show the power of 
decoy method. Given better QKD set-ups, decoy state method 
could make secure QKD at even longer distances. 
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Fig. 4. Simulation result of the set-up on which we implemented the 
weak+vacuum protocol. The intrinsic parameters of this set-up is shown in 
the third row of Table U Note that this set-up is different from the one we 
implemented one-decoy as reflected by the fact that in Table the values 
in row 3 are different from the values in row 2. Solid line: the theoretical 
limit of key generation rate. Its maximum transmission distance is about 
84km. Dashed line: the performance of weak+vacuum protocol. Its maximum 
distance is about 68km. Dotted line: the performance of one-decoy protocol. 
Its maximum distance is about 59km. Dashed and dotted line: the performance 
without decoy method. Its maximum distance is only 14km. 



We thus come to the conclusion: decoy method is ready for 
immediate real-life applications! 
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